RHSA-2010:0002 - Security Advisory

标题

An updated PyXML package that fixes one security issue is now available for
Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

描述

PyXML provides XML libraries for Python. The distribution contains a
validating XML parser, an implementation of the SAX and DOM programming
interfaces, and an interface to the Expat parser.

A buffer over-read flaw was found in the way PyXML's Expat parser handled
malformed UTF-8 sequences when processing XML files. A specially-crafted
XML file could cause Python applications using PyXML's Expat parser to
crash while parsing the file. (CVE-2009-3720)

This update makes PyXML use the system Expat library rather than its own
internal copy; therefore, users must install the RHSA-2009:1625 expat
update together with this PyXML update to resolve the CVE-2009-3720 issue.

All PyXML users should upgrade to this updated package, which changes PyXML
to use the system Expat library. After installing this update along with
RHSA-2009:1625, applications using the PyXML library must be restarted for
the update to take effect.

解决方案

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

受影响的产品

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.4 ia64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.4 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.8 ia64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.8 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

修复

• BZ - 531697 - CVE-2009-3720 expat: buffer over-read and crash on XML with malformed UTF-8 sequences

CVE

• CVE-2009-3720

参考

• http://www.redhat.com/security/updates/classification/#moderate